Enhancing Security Requirements Engineering by Organisational Learning

More and more software projects today are security-related in one way or the other. Requirements engineers often fail to recognise indicators for security problems which is a major source of security problems in practice. Identifying security-relevant requirements is labour-intensive and errorprone. In order to facilitate the security requirements elicitation process, we present an approach supporting organisational learning on security requirements by establishing company-wide experience resources, and a socio-technical network to benefit from them. The approach is based on modelling the flow of requirements and related experiences. Based on those models, we enable people to exchange experiences about security-requirements while they write and discuss project requirements. At the same time, the approach enables participating stakeholders to learn while they write requirements. This can increase security awareness and facilitate learning on both individual and organisational levels. As a basis for our approach, we introduce heuristic assistant tools which support reuse of existing security-related experiences. In particular, they include Bayesian classifiers which issue a warning automatically when new requirements seem to be security-relevant. Our results indicate that this is feasible, in particular if the classifier is trained with domain specific data and documents from previous projects. We show how the ability to identify security-relevant requirements can be improved using this approach. We illustrate our approach by providing a step-by-step example of how we improved the security requirements engineering process at the European Telecommunications Standards Institute (ETSI) and report on experiences made in this application.

Goal sketching: towards agile requirements engineering

This paper describes a technique that can be used as part of a simple and practical agile method for requirements engineering. The technique can be used together with Agile Programming to develop software in internet time. We illustrate the technique and introduce lazy refinement, responsibility composition and context sketching. Goal sketching has been used in a number of real-world development projects, one of which is described here.

Requirements engineering for web-based information systems

This chapter overviews the existing methods of requirements analysis as prescribed by some of the best-known web-development methods. It also discusses the pre-eminent importance of stakeholder analysis, identification of stakeholder views and concerns, and the processes governing elicitation of web systems requirements. The chapter finally derives a model of concern-driven requirements evolution from several case studies undertaken in the area of web-enabled employee service systems.

Promoting and supporting requirements engineering creativity

Requirements Engineering (RE) is a commencing phase in the systems development life cycle and concerned with understanding and specifying the customer's requirements. RE has been recognized as a complex cognitive problem solving process which takes place in an unstructured and poorly understood problem .context. A recent understanding describes the RE process as inherently creative, involving cycles of incremental building followed by insight-driven econceptualization .of the problem space. This chapter relates this new understanding to various creative process models described in the creativity and psychology of problem solving literature.

A review of current attempts to support problem solving in RE using
various design rationale approaches suggests., that their common major
wealmess lies in the lack of support for the creative and insight-driven problem solving process in RE. In addressing this weakness, the chapter suggests a new approach to promoting and supporting RE creativity using design rationale. The suggested approach involves the ad hoc recording of rationale to support the creative exploration complemented by a post hoc conceptual characterization of the problem space to support insight driven reconceptualization.

Managing the requirements engineering process

Process management is a crucial issue in developing information or computer systems. Theories of software development process management suggest that the process should be supported and managed based on what the process really is. However, our learning from an action research study reveals that the requirements engineering (RE) process differs significantly from that which the current literature tends to describe. The process is not a systematic, smooth and incremental evolution of the requirements model, but involves occasional simplification and restructuring of the requirements model. This revised understanding of the RE process suggests a new challenge to both the academic and industrial communities, demanding new process management approaches. In this paper, we present our understanding of the RE process and its implications for process management.

Managing the requirements engineering process

Process management is a crucial issue in developing information or computer systems. Theories of software development process management suggest that the process should be supported and managed based on what the process really is. However, our learning from an action research study reveals that the requirements engineering (RE) process differs significantly from what the current literature tends to describe. The process is not a systematic, smooth and incremental evolution of the requirements model, but involves occasional simplification and restructuring of the requirements model. This revised understanding of the RE process suggests a new challenge to both the academic and industrial communities, demanding new process management approaches. In this paper, we present our understanding of the RE process and its implications for process management.

Understanding problem solving in requirements engineering : debating creativity with IS practitioners

RE is well-recognised as a creative problem solving activity by the systems development community. However, while substantial research has been conducted and knowledge gained about creativity in the general psychology of problem solving, creativity as it applies to RE remains a relatively unexplored area - one that has neither been comprehensively studied, nor highly recognised, as a research topic of importance. This paper attempts to address the above mentioned gap by presenting findings from a recent focus group study of creativity in RE as perceived by a group of RE practitioners. We provide a conceptual framework for understanding creativity in RE, which may be of use to requirements engineers attempting to enable more creative approaches and results, as well as adding to the existing, limited body of research in this area.

Issues in IT service-oriented requirements engineering

Corporate information technology (IT) management is increasingly service-oriented, offering continuous evaluation and improvement of application, communication, delivery and support services to internal and external customers. Service-oriented requirements engineering (SoRE) plays a significant role in identifying and specifying service requirements, formally defined through service-level agreements (SLAs). However, the new frameworks and approaches emerging to guide these developments have not yet addressed how requirements for such services can be effectively developed, nor identified the diverse issues involved. We report a case study of a web services team development of requirements for an internal Service Desk service. The study revealed five main issues of concern when developing service provider requirements: service roles, responsibilities and accountability; service performance metrics; resolution of conflicting stakeholder service requirements; customer acceptance of service change; and service provider team structure. This study suggests that in the new IT services era, new techniques and approaches are needed for eliciting and determining provider and customer requirements that involve key stakeholder groups equitably and more closely negotiate the sometimes-conflicting provider and customer needs.

Understanding requirements engineering process: a challenge for practice and education

Reviews of the state of the professional practice in Requirements Engineering (RE) stress that the RE process is both complex and hard to describe, and suggest there is a significant difference between competent and "approved" practice. "Approved" practice is reflected by (in all likelihood, in fact, has its genesis in) RE education, so that the knowledge and skills taught to students do not match the knowledge and skills required and applied by competent practitioners.

A new understanding of the RE process has emerged from our recent study. RE is revealed as inherently creative, involving cycles of building and major reconstruction of the models developed, significantly different from the systematic and smoothly incremental process generally described in the literature. The process is better characterised as highly creative, opportunistic and insight driven. This mismatch between approved and actual practice provides a challenge to RE education - RE requires insight and creativity as well as technical knowledge. Traditional learning models applied to RE focus, however, on notation and prescribed processes acquired through repetition. We argue that traditional learning models fail to support the learning required for RE and propose both a new model based on cognitive flexibility and a framework for RE education to support this model.